Firewall Configuration Review
Firewall configuration reviews for any vendor. We read your rule base line by line and tell you which rules allow more than they should, which ones nobody uses and which no longer match how your network works.
What is a firewall configuration review?
A firewall configuration review is a check of a firewall’s rule base and settings rather than a test against it from outside. We work from an exported configuration, so nothing touches the live device. The review looks for rules that allow more than they need to (any to any, broad port ranges, permit rules above deny rules), rules nobody uses any more, management interfaces reachable from the wrong side, missing logging, out of date firmware and gaps between what the rule base says and what the network diagram says.
It is not the same as firewall support. We do not manage or reconfigure the firewall for you. What you get is a ranked list of what to change, written so that whoever does manage it, in house or at your MSP, can action it line by line. Any vendor is fine: FortiGate, Palo Alto, Cisco, Sophos, WatchGuard, Check Point, DrayTek, pfSense.
What the Review Covers
A firewall configuration review is a firewall rule review plus everything around it: interfaces, zones, NAT, VPN settings, management access, logging and firmware. Every rule is read for what it allows, why it is there and whether it is still needed. The review is static. We work from a copy of the configuration file taken from the device, so the live firewall is never touched and the network carries on as normal.
How Rule Bases Rot
Nobody sets out to build a permissive firewall. A rule is added for a migration and never removed. A supplier needs access for a week and keeps it for three years. Someone troubleshooting late at night opens any to any to prove it is not the firewall, then forgets to close it. Staff move on and nobody remembers what half the objects are for. Years later the rule base is long, contradictory and allows far more than anyone intended. The worst findings are often a broad permit placed above the deny that was meant to stop it.
What Good Looks Like
Every rule has an owner, a purpose and a date to review it. Inbound access is limited to what the business needs. Outbound traffic is filtered rather than left open. Management interfaces are reachable only from a management network. Logging is on for the rules that matter and the logs go somewhere someone reads them. Getting there usually means removing rules rather than buying anything.
What You Get From the Review
A Rule by Rule Verdict
Every rule assessed for what it allows and whether it is still needed, with the ones to remove or tighten clearly marked.
A Smaller Attack Surface
Open ports and broad access that no longer serve a purpose identified so they can be closed.
Audit Evidence
Findings that support PCI DSS Requirement 1, ISO 27001 and the firewall control in Cyber Essentials.
Changes Your Team Can Make
A ranked list written so whoever manages the firewall, in house or at your MSP, can action it line by line.
How the Review Runs
You send us a copy of the configuration file exported from the firewall. That is all we need to start, though a network diagram helps. Each rule is read for source, destination, service and action, then checked against its neighbours for shadowed rules, duplicates and permits that override a later deny. Interfaces, zones and NAT are reviewed to confirm traffic between segments is restricted as intended. Management access, logging, firmware version and VPN settings are checked against vendor hardening guidance. Findings are ranked by risk, with the exact rule or setting to change. Nothing is changed on the device and there is no disruption to your network.
At a Glance
Configuration Collection
Rules, interfaces, zones, NAT and logging read from a copy of the configuration file.
Rule Set Analysis
Identifying shadow rules, any to any permits, overly broad access and legacy entries.
Zone & Segmentation Review
Traffic between zones checked against how the network is meant to be divided.
Logging & Alerting
Logging confirmed on the rules that matter, with alerts going somewhere they will be seen.
Report & Retest
Prioritised findings with practical recommendations. Free retest included.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What does a firewall configuration review cover?
A firewall configuration review examines your firewall rule sets, interface configurations, NAT policies, zone definitions and logging settings. We look for overly permissive rules, legacy entries that are no longer needed, any to any policies, missing logging and zones that are not properly segmented. The review is vendor agnostic and covers technologies including Cisco, Fortinet, Palo Alto, Check Point, Sophos and cloud based firewalls in AWS and Azure.
How do firewall rule sets become insecure over time?
One change at a time. A rule added for a migration is never removed. A supplier’s temporary access becomes permanent. A troubleshooting change made under pressure is never reversed. Staff who knew why a rule existed move on. Each change made sense when it was made. Together they leave a rule base nobody fully understands, which is why PCI DSS asks for a review every six months.
Is firewall review required for PCI DSS compliance?
Yes. PCI DSS Requirement 1 specifically mandates the installation and maintenance of network security controls. This includes documenting firewall configurations, reviewing rule sets at least every six months and ensuring that only necessary traffic is permitted. Our firewall configuration review directly supports these requirements.
Do you need direct access to our firewall?
We can perform the review using exported configuration files, which avoids the need for direct access to your live firewall management interface. Where direct read-only access is preferred we can accommodate this. Either approach provides the same depth of analysis without any risk of disruption to your network.